Summary The Eurocopter AS350B2helicopter (C-GOGN, serial number2834) with the pilot and three passengers on board, all employees of the Ministry of Natural Resources, departed on a day, visual flight rules flight from SaultSte.Marie, Ontario, to conduct a moose survey at a location approximately 45nautical miles northeast of SaultSte.Marie. During the survey, at 1143 eastern standard time, the pilot communicated to the Ministry of Natural Resources ground-based radio operator that the aircraft experienced a hydraulic failure and that he was proceeding to a logging site at Mekatina to land the helicopter. As the helicopter approached the logging site, workers observed the aircraft proceed to the north and enter a left turn. As the helicopter proceeded back towards the logging operation in the left turn, control of the aircraft was lost and it crashed in the rising wooded terrain east of the logging site. The helicopter came to rest in an inverted position. All of the aircraft occupants were fatally injured. There was no post-crash fire. Ce rapport est galement disponible en franais. 1.0 Factual Information 1.1 History of the Flight The helicopter departed the Ministry of Natural Resources (MNR)1 ramp at SaultSte.Marie Airport, Ontario, at 0910 eastern standard time2 and landed at the slipway near the MNR Provincial Coordination Centre (PCC) where two resource technicians and one conservation officer boarded the aircraft. The helicopter departed the slipway at 0926 with an estimated time of 15minutes to reach Block72522, where a moose survey would commence. At 1143, the pilot reported that the aircraft had experienced a hydraulic failure and described the logging site where he was going to land. He announced as part of his last transmission that he anticipated a rough, spot landing. The helicopter approached the logging site from the west; the logging site was a valley with a rail line running north/south. The helicopter proceeded to the south and then flew northbound over rising terrain east of the logging site (seeAppendixA). Once on the east side, the helicopter levelled at approximately 50 feet above the trees, continued on a northerly heading until reaching the north end of the logging site, entered a left turn and proceeded back toward the witnesses. The helicopter remained in the left turn and in a left-banked attitude such that the witnesses, located approximately 600feet south, could clearly see the aircraft registration markings on the underside of the aircraft. The helicopter descended into the rising terrain and came to rest inverted on a heading of 080Magnetic. The accident occurred at 1144, at 4704'North latitude, 08404'West longitude, at an elevation of 1456feet above sea level (asl) during hours of daylight. 1.2 Injuries to Persons 1.3 Damage to Aircraft The aircraft was destroyed during the impact sequence. 1.4 Personnel Information Records show that the pilot was certified and qualified for the flight in accordance with existing regulations. He had flying experience on a variety of helicopters, namely Bell Helicopter, Sikorsky and Eurocopter, and had worked for a number of commercial helicopter operators across Canada. In2000, he joined MNR in the position of Chief Pilot - Rotary Wing. The training that the pilot received on the helicopter included hydraulic failures in all phases of flight. The pilot passed the AS350B2 Pilot Proficiency Check in2000, 2001and2002. He completed his most recent ground school and proficiency training on the helicopter inMay2002. There was no indication that incapacitation or physiological factors affected the pilot's performance. 1.5 Aircraft Information Records indicate that the aircraft was certified, equipped and maintained in accordance with existing regulations and approved procedures. The weight and centre of gravity were within the prescribed limits. 1.5.1 Aircraft Certification The first model of the AS350 series of helicopters to be certified in Canada was the AS350Cmodel, certified on 01June1978. The Direction Gnrale de l'Aviation Civile (DGAC), the French civil aviation authority, withdrew the certification of the AS350C model in1997. The C model is no longer certified in Canada. The AS350B was added to the type certificate data sheet in February1980. In June1988, Transport Canada (TC) Flight Test and Engineering specialists made a formal validation visit to Arospatiale (Eurocopter) France for the AS350B1 model. This visit validated the AS355F model at the same time. Seventeen issue papers were raised and subsequently closed. The issue papers were primarily for cold-soak requirements, aircraft flight manual (AFM) changes, and airworthiness limitations. There were no issue papers related to the hydraulic system. The AS350B1 was certified in Canada in July1988. The AS350B2 model was certified in December1990, following an extensive internal review of technical reports. This certification did not include a validation trip. There are no indications on TC files that any specific concerns regarding the hydraulic systems were raised during any of the certification reviews. 1.5.2 Hydraulic System 1.5.2.1 General Description The aircraft has a single hydraulic system to lighten control forces during flight and allow the aircraft to be flown at speeds where manual control loads may be excessive. The hydraulic system comprises the following: a power-generating section that consists of a hydraulic reservoir, a belt-driven pump, and a regulation and filtration unit; a power-absorbing section that consists of four servo controls (servos)3; and control and monitoring sections provided in the cockpit. Each of the four servos includes a hydraulic actuator and a hydraulic distributor. There are three main servos: a forward servo for pitch control, and left and right servos for roll control. Each main servo is equipped with a non-return valve, an accumulator and a solenoid valve. The fourth servo is a tail-rotor servo for yaw control. The tail-rotor servo system is equipped with a non-return valve, an accumulator (fastened to an input lever in the tail-rotor control system), a solenoid valve and a check valve. Hydraulic pressure to drive the main and tail-rotor servos is provided by a single gear-type pump, belt-driven from the main gearbox, that produces a constant outflow of six litres per minute. The pump flow rate is designed to cover servo requirements under all circumstances, and excess flow is diverted back to the hydraulic reservoir through a regulating valve that opens when the pressure exceeds 40bar.4 A hydraulic low-pressure switch and the hydraulic test solenoid valve are integral with the pressure regulator. The hydraulic low-pressure switch activates when the hydraulic pressure drops below approximately 30bar, illuminating the red hydraulic warning (HYD) light on the failure warning panel and producing a continuous tone from the warning horn. The light goes out and the horn stops when the pressure switch senses a pressure greater than approximately 30bar. The same horn provides warning of low main-rotor speed. A hydraulic CUTOFF switch on the collective is used in emergency situations to depressurize the accumulators by simultaneously opening the three main electro valves (dump valves), excluding the tail rotor, and to facilitate a smooth transition to manual controls. When the accumulators are exhausted, the control forces become significantly higher, though not unmanageable as long as the aircraft is operated in accordance with approved procedures. Selecting the CUTOFF switch will also cancel the warning horn. A hydraulic test toggle switch labelled HYDTEST, located on the Geneva panel,5 allows the main-rotor and tail-rotor servo accumulators to be tested. Placing the switch in the Test position causes the hydraulic test solenoid6 and the tail-rotor servo solenoid valve to open. This causes the hydraulic pressure to drop, resulting in illumination of the hydraulic warning light and activation of the warning horn. The accumulators are tested during the pre-flight check by selecting the HYD TEST switch to Test and moving the cyclic stick to verify that the accumulators are providing assistance. It is not normal practice to operate the HYD TEST switch in flight; the AS350B2AFM cautions against this, as operation of the switch depressurizes the accumulator in the tail-rotor (yaw compensator) servo, resulting in high yaw pedal forces. However, if a tail-rotor control failure is experienced during flight, the AFM instructs the pilot to select the switch to the Test position, wait five seconds, then select the switch to the normal position. The HYD TEST switch has a distinctly shaped lever and incorporates a pull-to-unlock operation, which distinguishes it from the switches that are located on either side of it. 1.5.2.2 Hydraulic System Failure Due to the possibility of hydraulic system failure, the aircraft was shown during certification to have adequate handling qualities when in the reversionary manual control mode, albeit with significantly higher control forces. However, at high speed, the loads are considered excessive, and a safety unit (comprising an accumulator, a non-return valve and a solenoid valve) was installed on each hydraulic servo. The accumulator charge allows the pilot time to safely reduce speed to where the manual control forces are more manageable; that is, below 60knots. During training and pre-flight testing of the hydraulic system, MNR pilots have experienced asymmetrical depletion of the hydraulic accumulators after selecting the HYD TEST switch to Test. Depending on the amount of control input, the typical time for the accumulators to bleed off is 20to30seconds. The AFM outlines two different types of hydraulic system failures. The emergency procedures to be followed in both cases are described below: collective pitch: 20kg pitch increase load; cyclic: 7 to 4kg left-hand cyclic load; cyclic: 2 to 4kg forward cyclic load; yaw pedals: practically no load in cruising flight. collective pitch: 20kg pitch increase load; cyclic: 7 to 4kg left-hand cyclic load; cyclic: 2 to 4kg forward cyclic load; yaw pedals: practically no load in cruising flight. Reduce speed to 60knots and proceed as in the case of illumination of the HYD light. calmly reduce collective pitch and adjust the airspeed to between 40and 60knots in level flight; cut off the hydraulic pressure, using the collective lever pushbutton.7 Control loads are felt on the collective pitch increase, on forward and left-hand cyclic; if necessary, increase indicated airspeed, but the control load feedback will also increase; make a flat approach over a clear landing area and land with slight forward speed; shut down the engine, holding the collective pitch lever on the low pitch stop. calmly reduce collective pitch and adjust the airspeed to between 40and 60knots in level flight; cut off the hydraulic pressure, using the collective lever pushbutton.7 Control loads are felt on the collective pitch increase, on forward and left-hand cyclic; if necessary, increase indicated airspeed, but the control load feedback will also increase; make a flat approach over a clear landing area and land with slight forward speed; shut down the engine, holding the collective pitch lever on the low pitch stop. In case of a hydraulic failure, the main servo non-return valves are closed by accumulator pressure (accumulator flow is only used by the servo). The main servo solenoid valves are controlled by the CUTOFF switch on the collective lever. The pilot selects the CUTOFF switch to the cut-off position, activating the three main servo solenoid valves. This opens the servo's pressure inlet to the return line, allowing simultaneous depressurization of the accumulators. This is designed to dump the hydraulic system pressure to zero, and also to ensure the accumulator pressures are rapidly depleted to zero symmetrically. Both these functions are required for safe operation. Dumping system pressure to zero is required to enable the pilot to depower the flight controls due to system failure or misbehaviour. Depressurizing the accumulators symmetrically and rapidly is designed to provide consistent behaviour of the flight controls when transitioning from powered to unpowered flight controls. The tail-rotor servo non-return valve is also closed by accumulator pressure and the accumulator provides reserve pressure. Unlike the main servos, the tail-rotor servo system is designed such that it can provide an almost unlimited supply of reserve pressure. If the pressure within the tail-rotor servo system exceeds 55bar, the check valve opens the pressure line to return and allows a partial hydraulic flow as the servo piston returns to the extend position. This prevents hydraulic locking and causes the stored pressure to be reduced. 1.6 Meteorological Information The 1600 UTC8 METAR (aviation routine weather report) for Sault Ste. Marie reported the wind from 080True at 4knots, visibility 15statute miles, broken clouds at 5400feet, temperature -24C, dewpoint -29C, and altimeter setting30.13. There were good visual meteorological conditions at Mekatina, with clear skies, calm wind and a temperature of -30C. 1.7 Communications All pilot communications with SaultSte.Marie Airport tower were normal. After picking up the three passengers and proceeding to the north to conduct the moose survey, the pilot's communications were solely with a ground-based radio operator in SaultSte.Marie. These communications were not tape recorded; however, they were documented on a radio log by the radio operator. The pilot's last transmission was logged at 1143, in which he announced that the aircraft had experienced a hydraulic failure. He described the logging area he was flying over, gave his position as 39nautical miles north, and communicated that a spot landing may be rough. The aircraft warning horn did not sound during this communique. There were no further communications between the pilot and the radio operator. The radio operator communicated with the PCC regarding C-GOGN's predicament, and these communications were recorded at the PCC. A review of the communications indicated that the appropriate search proceedings began right away. 1.8 Flight Recorders 1.8.1 General The aircraft was not equipped with a flight data recorder or a cockpit voice recorder, nor was either required by regulation. 1.8.2 Aircraft Tracking System The helicopter was equipped with a company-monitored aircraft tracking system (ATS) that provided regular position reports every 30 seconds based on latitude and longitude coordinates obtained through the international global positioning system (GPS). Additional information, such as aircraft altitude and calculated speed, is also available from the data. A plot of the GPS position points (e.g. No.247) for C-GOGN is shown in AppendixA. The points are joined by straight lines, as actual aircraft manoeuvring between GPS position points is unknown. The available information indicates the following: 1.9 Wreckage and Impact Information 1.9.1 General The impact area was located approximately 150feet east of the Mekatina rail siding. The area is characterized by rising terrain with light to dense forestation and an average tree height of about 80feet. The snow depth was two to three feet in the localized occurrence area. The helicopter struck and cut tree tops prior to striking the ground in a steep, nose-down, inverted attitude. The nose section, windscreen and overhead roof section were completely destroyed on impact. All three main-rotor blades were extensively damaged at the time of impact, but remained attached to the rotor head. The engine (Turbomeca Arriel 1D1, serial No.9359) was attached to the helicopter; however, the mounts were damaged. Damage to the engine was unremarkable and consisted mainly of distortion of the intake and exhaust. The fuel tank, located in a compartment behind the rear seats and under the upper deck, was completely shattered. The snow and ground under the helicopter were saturated in jet fuel, hydraulic fluid and engine oil. The tail section of the helicopter was fractured approximately five feet aft of the attachment to the fuselage, but remained attached. The tail-rotor drive shafts were damaged. The aircraft wreckage was recovered and transported to SaultSte. Marie Airport for further examination. 1.9.2 Flight Controls A detailed inspection of the flight control system was conducted. There were no indications of pre-impact failure, and no discrepancies were noted that would indicate a pre-existing condition that would have prevented normal operation. 1.9.3 Hydraulic System A visual examination of the aircraft hydraulic system showed no signs of pre-impact failure of any of the mechanical components. However, the hydraulic pump drive belt was found to have fractured at a manufacturing seam where the two ends were bonded together. The belt (part number704A33-690-004; total time since new - 390hours) has an in-service life of 600hours. The drive belt is a coated fabric construction, consisting of an outer coated fabric layer, two interply layers (one rubber, one fabric) and an inner rubber coating. A failure of this belt would account for the hydraulic failure reported by the pilot. The broken belt, a number of similar unbroken belts from other MNR helicopters, and one new belt were submitted to the TSB Engineering Laboratory for examination. It was determined that the belts that had been in service were longer than the new belt. This is not considered unusual, since normal service would slightly stretch a drive belt, reducing its tension. Microscopic examination of the belts was conducted. With the exception of the new belt, extensive cracking was observed in all the comparison samples at the same location as the failure location of the occurrence drive belt. It could not be determined if the belt had failed prior to the crash; however, the cracking of the belt was examined and the belt was assessed as being close to failure prior to the crash. Prior to the accident, as part of their normal maintenance activities, MNR maintenance personnel visually checked the belt condition on a daily basis. They also checked belt tension by feel and by attempting to turn the pulley. If the pulley turned and the belt slipped, the belt was considered to be loose. During 100-hour inspections, the belt was visually checked for damage, feel checked for tension, and adjusted if necessary. MNR maintenance personnel replaced the belt at the 500-hour T check, although the check only called for the belt tension to be checked. All servo accumulators should have a nitrogen head pressure of approximately 15bar. During the examination of the wreckage, the pressures in the three main-rotor servo accumulators were all found to be approximately 6bar, and the tail-rotor servo accumulator pressure was found to be approximately 22bar. When a hydraulic line was removed from the tail-rotor servo, hydraulic fluid sprayed out under pressure. The hydraulic components were removed from the aircraft and extensively tested, both at room temperature and while cold-soaked to -35C. No anomalies were detected. Photo2. Hydraulic CUTOFF switch and guard Photo3.Hydraulic HYD TEST switch The hydraulic CUTOFF switch (Photo2) on the collective was found in the forward or normal position. The switch guard was broken by impact forces and the switch housing was bent rearward. Because of the extent of the damage to the switch, the switch position prior to impact could not be determined, nor could the switch be tested for electrical continuity. The switch was disassembled and no discrepancies were noted that would indicate a pre-existing condition that may have prevented normal operation. This switch is powered through the hydraulic circuit breaker(CB). The HYD TEST switch (Photo3) was found in the forward or Test position. The pull-to-unlock design of the HYDTEST switch requires the toggle lever to be lifted up, then over the locking mechanism. Impact marks on the switch indicate that it was likely in the forward position at the time of impact. A continuity check and function testing were performed on the switch and no discrepancies were noted. This switch is powered through the hydraulicCB. The hydraulic CUTOFF switch (Photo2) on the collective was found in the forward or normal position. The switch guard was broken by impact forces and the switch housing was bent rearward. Because of the extent of the damage to the switch, the switch position prior to impact could not be determined, nor could the switch be tested for electrical continuity. The switch was disassembled and no discrepancies were noted that would indicate a pre-existing condition that may have prevented normal operation. This switch is powered through the hydraulic circuit breaker(CB). The HYD TEST switch (Photo3) was found in the forward or Test position. The pull-to-unlock design of the HYDTEST switch requires the toggle lever to be lifted up, then over the locking mechanism. Impact marks on the switch indicate that it was likely in the forward position at the time of impact. A continuity check and function testing were performed on the switch and no discrepancies were noted. This switch is powered through the hydraulicCB. Six hydraulic fluid samples were forwarded to the Quality Engineering Test Establishment, Department of National Defence. The test results indicated a water content ranging from 44to 75parts per million (ppm); the maximum allowable limit was 100ppm. The test results did not identify any other contaminants. 1.9.4 Caution/Warning Lights/Horn and Electrical System Stretching in the filament indicates that the light bulb in the red HYD warning light was on at the time of impact. This light illuminates when the hydraulic pressure drops below approximately 30bar. The light bulbs in the DOORS and FUEL P caution lights exhibited stretching of their filaments and were considered to have been on as a result of the breakup of the helicopter at the time of the impact. The light bulb filaments in the remaining caution and warning lights were not stretched, and all were considered to have been off at the time of impact. The warning horn for hydraulic pressure was function-tested, and it was determined that the horn was likely functional prior to the impact. The warning horn mute switch was found in the AFT (mute) position. A continuity check was carried out on the aircraft's wiring system. With the exception of the hydraulic CUTOFF switch, which could not be tested due to damage, no discrepancies were noted. A continuity check was carried out by the TSB Engineering Laboratory on the Geneva panel wiring from the applicable pins in the quick-connect plugs to the Hydraulics and Rotor Warn CBs, and to the WARNING HORN and HYD TEST switches. No discrepancies were noted that would indicate a pre-existing failure condition that would have prevented normal operation. 1.9.5 Circuit Breakers The hydraulic CB was found in the tripped position. This CB, located in the upper right-hand side of the CB panel, was the only CB in this panel that was tripped. The white trip indicator ring portion of the hydraulic CB had black streaks and an overall dirty appearance. When compared to other CBs on the same panel, none of the others exhibited a similar appearance to the white trip indicator ring. It was, therefore, assessed that the hydraulic CB was in the tripped position in flight. To determine if the hydraulic CB could have tripped due to an electrical fault, the CB was examined and tested, and a wiring continuity check was carried out on the related wiring. No discrepancies were noted. Another option is that the CB was intentionally tripped by the pilot. This was considered highly unlikely since pulling the CB is not part of the emergency procedure, and it would be difficult for the pilot to readily identify the CB due to its location. The hydraulic CB supplies power to both the HYDTEST switch and the hydraulic CUTOFF switch; therefore, activation of the HYDTEST switch or the hydraulic CUTOFF switch would have no effect with the hydraulicCB in the tripped position. The rotor warningCB was found in the set position. This CBsupplies power to the warning horn and the HORN caution light through the warning horn printed circuit board and the warning horn switch. 1.9.6 Summary Chart The following chart summarizes the information from Section1.9, highlighting the asfound status, or position of the various switches or components, as opposed to the anticipated status or position if the helicopter had been configured according to flight manual requirements and expected pilot actions with a hydraulic failure. 1.10 Survival Aspects Witnesses ran to the crash site and immediately rendered assistance to the aircraft occupants. The aircraft came to rest in an inverted position, and the rescuers used a come-along chain to position the aircraft onto its side to gain access to the occupants. All of the occupants were wearing seat belts. The belts were cut in order to extricate the occupants from the wreckage. The Rescue Coordination Centre dispatched a C130Hercules aircraft from SaultSte.Marie Airport, and search and rescue technicians attended the site. The accident was not survivable due to the high-impact forces. The emergency locator transmitter activated during the crash and was turned off by a pilot who attended the site. 1.11 Organizational and Management Information The objective of the MNR aviation program is to provide or arrange safe and efficient flying services for forest fire management, for other programs in MNR, and for other ministries and agencies in the Ontario government. As of the occurrence date, the MNR had 36aircraft listed on the Canadian Civil Aircraft Register. Four of these aircraft are Eurocopter AS350B2 helicopters, includingC-GOGN. 1.12 Additional Information 1.12.1 Incident Involving Another AS 350 B2 Helicopter On 12May2003, an incident occurred during the pre-flight check of an AS 350B2 helicopter at another operator (Remote Helicopters) in Alberta. The hydraulic system was shut off using the HYD TEST switch and the controls cycled to ensure that all hydraulic pressure provided by the servo accumulators was depleted. During this pre-flight check and after the accumulators were depleted, the cyclic control moved uncommanded to an extreme left position. Considerable force was required to move the cyclic. The uncommanded movement was repeatable. A servo actuator manufactured by SAMM had been isolated as the cause and was removed for further investigation. No anomalies were detected during this examination. Initiatives to try to isolate potential servo failure modes, and mitigation efforts, are described in the Safety Action section of this report. 1.12.2 TSB/TC Working Group On 14 May 2003, the TSB convened a working group with TC personnel to examine in detail the data gathered during the investigation into the accident of C-GOGN. The working group met again at the TSB Engineering Laboratory on 28May2003, to witness the tear down of the hydraulic components and discuss potential safety action. The working group conducted a final meeting at the TSB Engineering Laboratory on 09July2003. This meeting was attended by representatives of TSB, TC, DGAC (France), Eurocopter France and Eurocopter Canada. As a direct result of the working group's activities, TC issued Airworthiness Notice (AN) D006, Edition1, on 23September2003. The content of the AN is discussed in the Safety Action section of this report.